Potential Impact on Processors in the POWER Family
By IBM Team
February 12, 2018
Three security vulnerabilities that allow unauthorized users to bypass the hardware barrier between applications and kernel memory have been made public. These vulnerabilities all make use of speculative execution to perform side-channel information disclosure attacks. The first two vulnerabilities, CVE-2017-5753 and CVE-2017- 5715, are collectively known as Spectre, and allow user-level code to infer data from unauthorized memory; the third vulnerability, CVE-2017-5754, is known as Meltdown, and allows user-level code to infer the contents of kernel memory. The vulnerabilities are all variants of the same class of attacks but differ in the way that speculative execution is exploited.
These vulnerabilities do not allow an external unauthorized party to gain access to a machine, but they could allow a party that has access to the system to access unauthorized data.
If these vulnerabilities pose a risk to your environment, then the first line of defense is the firewalls and security tools that most organizations already have in place.
Mitigation of these vulnerabilities for Power Systems clients involves installing patches to both system firmware and operating systems. The firmware patch provides partial remediation to these vulnerabilities and is a pre-requisite for the OS patch to be effective. These will be available as follows:
We will continue to provide information about these patches via PSIRT and security bulletins.
Clients should review these patches in the context of their datacenter environment and standard evaluation practices to determine if they should be applied.